45 lines
1.4 KiB
YAML
45 lines
1.4 KiB
YAML
---
|
|
#--------------------------------------------------------------#
|
|
# add & trust ca cert to all nodes [node_ca]
|
|
#--------------------------------------------------------------#
|
|
# files/pki/ca/ca.crt should exist, which is generated role `CA`
|
|
- name: node add and trust ca cert
|
|
tags: node_ca
|
|
block:
|
|
|
|
# make /etc/pki cert dir
|
|
- name: create node pki dir
|
|
file: path=/etc/pki state=directory
|
|
|
|
# rhel: /etc/pki , debian: /etc/ssl/certs
|
|
- name: add ca.crt to node
|
|
copy:
|
|
src: files/pki/ca/ca.crt
|
|
dest: /etc/pki/ca.crt
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
# rhel: /etc/pki/ca-trust/source/anchors/ca.crt
|
|
# debian: /usr/local/share/ca-certificates/ca.crt
|
|
- name: trust ca.crt on node
|
|
shell: |
|
|
{% if os_package|default('rpm') == 'deb' %}
|
|
# debian
|
|
rm -rf /usr/local/share/ca-certificates/ca.crt
|
|
ln -s /etc/pki/ca.crt /usr/local/share/ca-certificates/ca.crt
|
|
/usr/sbin/update-ca-certificates
|
|
{% else %}
|
|
# rhel
|
|
rm -rf /etc/pki/ca-trust/source/anchors/ca.crt
|
|
ln -s /etc/pki/ca.crt /etc/pki/ca-trust/source/anchors/ca.crt
|
|
/bin/update-ca-trust
|
|
{% endif %}
|
|
args: { executable: /bin/bash }
|
|
# ubuntu/debian may return non-0 code with warning
|
|
register: ca_trust_result
|
|
failed_when:
|
|
- ca_trust_result.rc != 0
|
|
- "'warning: skipping' not in ca_trust_result.stderr"
|
|
|
|
... |